Bug 121117

Summary:	Single-user shell should run as sysadm_r, not system_r
Product:	[Fedora] Fedora	Reporter:	Aleksey Nogin <aleksey>
Component:	selinux-policy-strict	Assignee:	Daniel Walsh <dwalsh>
Status:	CLOSED RAWHIDE	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	rawhide	CC:	dwalsh, leonard-rh-bugzilla
Target Milestone:	---	Keywords:	SELinux
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2004-10-12 13:53:03 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:
Bug Blocks:	114963, 123268

Description Aleksey Nogin 2004-04-17 15:16:42 UTC

Because the single-user shell in running as system_r, not as sysadm_r,
 many things (including su, sudo and mail) fail to work (avc messages
below). It seems that running an interactive shell as system_r is
wrong in the first place, and it should be sysadm_r instead.

audit(1082188457.323:0): security_compute_sid:  invalid context
system_u:system_r:sysadm_mail_t for
scontext=system_u:system_r:sysadm_t
tcontext=system_u:object_r:sendmail_exec_t tclass=process
audit(1082188479.788:0): security_compute_sid:  invalid context
system_u:system_r:newrole_t for scontext=system_u:system_r:sysadm_t
tcontext=system_u:object_r:newrole_exec_t tclass=process
audit(1082188495.235:0): security_compute_sid:  invalid context
system_u:system_r:sysadm_sudo_t for
scontext=system_u:system_r:sysadm_t
tcontext=system_u:object_r:sudo_exec_t tclass=process
audit(1082189175.512:0): security_compute_sid:  invalid context
system_u:system_r:sysadm_chkpwd_t for
scontext=system_u:system_r:sysadm_su_t
tcontext=system_u:object_r:chkpwd_exec_t tclass=process

Comment 1 Bill Nottingham 2004-10-11 19:18:07 UTC

This is a policy bug. Is this strict or targeted policy?

Comment 2 Bill Nottingham 2004-10-11 19:21:44 UTC

Also, does it still occur - this *looks* to be fixed in the current
strict policy.

Comment 3 Aleksey Nogin 2004-10-11 19:25:58 UTC

> Is this strict or targeted policy?

This was before the policy was split.

> Also, does it still occur

I am still running FC2, so I do not know.

Comment 4 Daniel Walsh 2004-10-12 13:53:03 UTC

I am marking this as fixed in Rawhide.